
INDIANA DATA BREACH NOTIFICATION FORM 

OAG Form 1079 (R1 / 09-14) 

Identity Theft Unit 


OFFICE OF ATTORNEY GENERAL 
Consumer Protection Division 
Government Center South, 5 m floor 
302 W. Washington Street 
Indianapolis. IN 46204 
(317) 233-4393 - Fax 


Name and Address of Entity or Person that owns or licenses the data subject to the breach 


Name 

Johnson, Hearn, Vinegar & Gee, PLLC 


Street Address 

434 Fayetteville St #1800 


Submitted by 
Paulette Thomas 


City 

Raleigh 


Title 

Counsel 


Firm Name and Address (if different than entity) 

Baker Hostetler LLP 312 Walnut Street Cincinnati OH 45202-4074 


Email 

pmthomas@bakeriaw.com 


Zip Code 
27601 


Dated 

04/14/2017 


Telephone 

513.929.3483 


Relationship to Entity whose information was compromised 
Counsel 


| Type of Organization (please select one) 


| 

fl Slate of Indiana Government Agency 

EH Health Care 

0 Not-For-Profit 

1 1 Other Government Entity 

0 Financial Services 

0 Other-please specify 

0 Educational 

I7j other Commercial 



Number of Persons Affected 



Dates 


00 

Date Breach Occurred (Include start/end dates if known) 

1/16/2017 

1/16/2017 

Date Breach Discovered 

1/16/2017 


Date Consumers Notified 

04/17/2017 



Reason for delay, if any, in sending notification 


Notice is being provided without unreasonable delay following an investigation to determine the nature and scope of the Incident. 


1 Description of Breach (select all that apply) 


. 

0 Inadvertent disclosure 

[71 External system breach (e.g. hacking) 


0 Insider wrong-doing 

0 Loss or theft of device or media (e.g. computer, laptop, external 
hard drive, thumb drive. CD, tape) 

0 Other 



Information Acquired (select all that apply) 

0 Social Security Number 

0 Name in combination with (select all that apply) 

0 Driver's License Number 0 Slate Identification Number 

0 Credit Card or Financial Account Information 

□ Debit Card Number (In combination with security code, access code, password or PIN for account) 


l ist dates of previous breach notifications (within last 12 months) 
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Manner of Notification to Affected Persons 


Atfac/i a copy of a sample notification letter 
0 Written 
□ Electronic (email) 

CD Telephone 


Identity Theft Protection Service Offered 


0 Yes 
□ No 


Brief Description of Service: 

credit monitoring and identity theft protection services 




Duration 

one year 

Provider 

Experian 


Since this breach, we have taken the following steps to ensure it does not reoccur ( attach additional pages if necessary) 


To help prevent something like this from happening in the future. Johnson Hearn has enhanced the security of their systems, 


Any other information that may be relevant to the Oflicc of Attorney General in reviewing this Incident ( attach additional pages If necessary) 


We are writing on behalf of our client, Johnson, Hearn, Vinegar & Gee PLLC (Johnson Hearn), to notify you of a security incident 
involving Indiana residents. On January 16, 2017, our client became aware of a ransomware attack of their computer system. Our 
client immediately began an investigation, reset passwords, removed the server from the system, and began using a back-up of their 
system. As part of their investigation, Johnson Hearn engaged a leading forensic firm, and it determined that an unknown person 
remotely accessed a server which contained files that may have included individuals’ names, dates of birth, driver's license numbers 
or state issued identification numbers, social security numbers, financial information such as checking/savings account numbers, 
financial investment information, payment card information, and health insurance numbers . Although no evidence has been found 
that the unknown person accessed or acquired personal information, the nature of the incident is such that we cannot rule out that 
possibility, Johnson Hearn is notifying 2 Indiana residents in substantially the same form as the letter attached hereto, with written 
notification commencing today, April 14, 2017. Notification is being made without unreasonable delay. Johnson Hearn is offering 
affected individuals a complimentary one-year membership of Experian’s® IdentityWorks. This report is not, and does not constitute, 
a waiver of personal jurisdiction, 


















